I run debian with full encryption and wonder why I would also need a password protection for the bootloader...
If the attacker has had full physical access to your device, your password protection is void and null because the attacker could:
- plant a hardware backdoor
- change your initrd in ways which allow to compromise your boot process and the installed OS
The GRUB password might protect from inexperienced hackers but not from sophisticated ones. I personally use full disk encryption and I didn't set the GRUB password.